16 matches found
CVE-2026-103057
AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...
CVE-2026-103057
AiSOC versions 5.1.0 before 12.0.0 are vulnerable to an authentication bypass in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push . This flaw allows attackers to post arbitrary events using spoofed tenant identifiers , enabling them to broadcast malicious...
CVE-2026-103057 AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints
AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...
CVE-2026-103057 AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints
AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...
CVE-2026-103057 AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints
AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...
EUVD-2026-89541
AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...
CVE-2026-103057: Missing Authentication for Critical Function
AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...
Embedded Assessments for Frontier AI
Third-party evaluations for frontier AI have mostly tested models through external interfaces before deployment. But the risks from frontier AI models depend on how their developers use and govern them internally. Recently, CEOs of frontier AI companies have committed to hosting embedded...
CVE-2026-72554 Ladybird Web Solution Faveo Helpdesk - Broken Access Control
A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticat...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via the ExecTool.Execute function in the exec tool component. An attacker can execute arbitrary operating system commands by providing crafted input to this function. Remediation There is no fixed version for...
CVE-2026-15669
Technical details (affected products, vulnerable components, exploit vectors) are not publicly available in the provided documents. Monitor for updates.
CVE-2026-15668: Server-Side Request Forgery (SSRF)
A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotel...
CVE-2026-15629: Improper Link Resolution Before File Access
A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The...
Red Hat Runtimes Inventory Operator 安全漏洞
Red Hat Runtimes Inventory Operator is a program runtime environment management software from Red Hat USA. A security vulnerability exists in Red Hat Runtimes Inventory Operator that stems from a misconfiguration of the internal agent component, which could cause a standard user to execute...
In0ri - Defacement Detection With Deep Learning
In0ri is a defacement detection system utilizing a image-classification convolutional neural network. Introduction When monitoring a website, In0ri will periodically take a screenshot of the website then put it through a preprocessor that will resize the image down to 250x250px and numericalize t...
